FTX hacker uses Bitcoin mixer to transfer stolen assets to OKX.

At present, the hacker has transferred at least 225 BTC to OKX.

ZachXBT said the FTX hacker began putting BTC into ChipMixer on Nov. 20, via Ren Bridge, a cryptocurrency bridge.

[{"selector":"#anim-5660dd7f-0e5b-4ecd-ab38-5f6f69fb9bb7","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-d52ea8ea-d62f-4fa3-9e99-444b2368807c","keyframes":{"transform":["translate3d(0px, 95.37037%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

Each address follows a similar pattern: "withdraw from CM," "50% peels off," "50% deposited to OKX."

[{"selector":"#anim-684db0c0-b9ff-44ab-90c8-0f3ccd4efb3d","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-c176c185-56e9-49e8-9437-d79681f455b5","keyframes":{"transform":["translate3d(0px, 77.25444%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

OKX's director tweeted that the company is studying wallet flow.

[{"selector":"#anim-9d150238-f368-4cbf-bb98-50ec73263cb0","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-b63011d0-4a38-4c51-8730-929f1f6e4921","keyframes":{"transform":["translate3d(0px, 70.73270%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

The hack was reported on Nov. 12 after FTX's bankruptcy.

[{"selector":"#anim-9afa9998-da0f-4e17-aa63-d85df3c9bbe1","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-8725c619-b323-4869-a62d-76477dd0b1fc","keyframes":{"transform":["translate3d(0px, 70.73270%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

The hacker started moving their Ether (ETH) on Nov. 20.

[{"selector":"#anim-639e1b76-2112-4605-92a7-aa2e1929314c","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-5a94d6ea-a911-4c67-a82d-ad5bab0d5968","keyframes":{"transform":["translate3d(0px, 70.73270%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}]

The fact that hackers drained assets from FTX global and FTX.US at the same time, despite their being autonomous, sparked conjecture it was an inside operation.

[{"selector":"#anim-97fa5578-d285-4481-9bab-38919e0f5ce2","keyframes":{"opacity":[0,1]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] [{"selector":"#anim-67a04ea5-70da-491b-a5f1-72f2cba792d0","keyframes":{"transform":["translate3d(0px, 95.00806%, 0)","translate3d(0px, 0px, 0)"]},"delay":0,"duration":600,"easing":"cubic-bezier(0.2, 0.6, 0.0, 1)","fill":"both"}] Read more